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(1) Real Party in Interest 

A statement identifying by name the real party in interest 
is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, 
interferences, or judicial proceedings which will directly 
affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal, 

(3) Status of Claims 

The statement of the status of claims contained in the 
brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after 
final rejection contained in the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the 
brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be 
reviewed on appeal is correct. 

NEW GROUND (S) OF REJECTION 
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Claim 31 is rejected under35 U.S.C. 103(a) as being 
unpatentable over WFP in view of Rickey et al (US 20020166059) 
and further in view of Stevens (US 20020133702) . This rejection 
was improperly rejected only under WFP in view of Rickey, when 
claim 31 depends from claim 8 which was rejected under WFP in 
view Rickey et al and further in view of Stevens and is hereby 
corrected. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix 
to the brief is correct. 

(8) Evidence Relied Upon 

"Q222193 - Description of the Windows 2000 Windows File 
Protection Feature, 1 1 Microsoft, 8 July 1999, pp. 1-5. 
20020166059 RICKEY et al. 11-2002 

200201337 02 STEVENS 9-2002 

(9) Grounds of Rejection 

The following ground (s) of rejection are applicable to the 
appealed claims: 

Claim Rejections - 35 USC §103 

The text of those sections of Title 35, U.S. Code not 
included in this action can be found in a prior Office action. 

Claims 1-7, 9-20, 22-28, and 30 are rejected under 35 
U.S.C. 103(a) as being unpatentable over "Q222193 - Description 
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of the Windows 2000 Windows File Protection Feature" 
(hereinafter WFP) and further in view of Rickey et al (US 
20020166059) . 

As per claims 1, 14, and 27, WFP discloses identifying 
factors associated with a computer; monitoring requests to write 
to files on the computer; and conditionally preventing the 
writes to the tiles on the computer based on the factors; 
wherein the factors are altered based on the monitoring of the 
requests (see pages 1-2) . 

WFP fails to disclose the preventing of writing is to 
prevent virus proliferation. 

However, Rickey et al teaches viruses entering a system 
through critical files (see paragraph 63) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use WFP's method of 
blocking writes to files to prevent viruses from entering the 
system as in Rickey et al. 

Motivation to do so would have been to obtain higher 
security (see Rickey et al paragraph 64) . 

As per claims 2 and 15, the modified WFP and Rickey et al 
system discloses the factors are selected from the group 
consisting of critical files, critical file locations, and 
trusted applications (see WPF page 2) . 
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As per claims 3-4 and 16-17, the modified WFP and Rickey et 
al system discloses the factors are user configurable and 
identified in a registry (see page 2) . 

As per claims 5-7, 18-20 and 28, the modified WFP and 
Rickey et al system discloses the factors include critical files 
and critical file folder locations associated with an operating 
system of the computer (see pages 1-2) . 

As per claims 9-11 and 22-24, the modified WFP and Rickey 
et al system discloses the factors are updated based on a user 
request, the factors are updated remotely, and the factors are 
updated based on the requests (see pages 2-3) . 

As per claims 12-13 and 25-26, the modified WFP and Rickey 
et al system discloses conditionally preventing the writes to 
the files on the computer based on a user confirmation and the 
factors are updated based on the user confirmation (see bottom 
of page 2) . 

As per claim 30, the modified WFP and Rickey et al system 
discloses the factors include a list of critical files such that 
the list of critical files is updated based on the requests (see 
WFP page 2) . 

Claims 8, 21 and 31 rejected under 35 U.S.C. 103(a) as 
being unpatentable over the modified WFP and Rickey et al system 
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as applied to claims 2 and 15 above, and further in view of 
Stevens (US 20020133702). 

As per claims 8 and 21, the modified WFP and Rickey et al 
system fails to disclose the factors include trusted 
applications that initiate the requests. 

However, Stevens teaches a trusted application (see 
paragraph 19) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use Stevens' trusted 
application in the file protection system of WFP and Rickey et 
al. 

Motivation to do so would have been to allow trusted 
applications to access protected information (see paragraph 19) . 

NEW GROUND (S) OF REJECTION 

As per claim 31, the modified WFP, Rickey et al, and 
Stevens system discloses if one of the requests is initiated by 
an application that is not one of the trusted applications a 
user is alerted and allowed to at least one of prevent and 
permit the request initiated by the application (see WFP page 1 
and Stevens paragraph 19) . 
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(10) Response to Argument 
WFP in view of Rickey et al. 

Group #1: Claims 1-2, 4-7, 13-15, 17-20, and 26-27 

Appellant argues the WFP fails to disclose factors are 
altered based on monitoring of the write requests. As described 
on page 4 of Appellant's specification, "the factors are 
selected from the group consisting of critical files, critical 
file locations, and trusted applications . " Therefore the 
critical files of WFP are the claimed factors. WFP monitors a 
file system to determine when a file has been modified, and 
whenever a file is modified a write call occurs in the system 
and with every write call exists a write request, therefore, WFP 
monitors write requests. Once WFP determines a file has been 
modified to an incorrect version, the system replaces the file 
with the correct version, which is altering the file based on 
the modification, i.e. write request. Appellant further argues 
that restoring a file is not altering factors, however, since 
files are factors, as disclosed in Appellant's specification, 
changing a modified file to a correct version is altering that 
factor . 

Appellant also argues that WFP occurs after a file has been 
modified and the limitation of preventing writes to a file 
cannot be taught by WFP. However, when a modification to a file 
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protected by WFP is made that places it in an incorrect version, 
it is replaced with the correct version. This replacement is 
based on the determination that the file is an incorrect 
version, thereby preventing the incorrect version from being 
written. Wherein monitoring for modifications corresponds to 
monitoring write requests as discussed above. 

Appellant further argues that WFP fails to disclose 
updating the factors based on the write requests because WFP 
discloses a file being replaced. Again the file is the factor 
and when the incorrect version of a file is detected it is 
replaced with the correct version based on the detection, i.e. 
the file is updated to the correct version. Wherein monitoring 
for modifications corresponds to monitoring write requests as 
discussed above. 

Group #2: Claim 28 

Appellant argues that WFP fails to disclose a least one of 
critical files and critical file locations are looked up based 
on requests to write to the at least one of critical files and 
critical file locations. WFP disclose that when a file is 
modified to an incorrect version, the correct version of that 
file is looked up and replaced with the correct version of the 
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file from a cache as shown on the bottom of page 1 to the top of 
page 2 and is therefore looked up based on the request to write. 

Group #3: Claims 3 and 16 

Appellant argues that WFP fails to disclose that the 
factors are user configurable. With respect to this argument on 
page 2 WFP states that the cache size can be adjusted by the 
administrator, therefore depending on the size of the cache a 
different number of factors will be stored and is thereby 
configurable by the administrative user. 

Group #4: Claims 9, 10, 22, and 23 

Appellant argues that WFP fails to disclose updating 
factors based on a user request and updated from a location via 
a network because WFP responds to modifications not requests and 
there is no updating. With respect to this argument the System 
File Checker tool, "gives an administrator the ability to scan 
all protected files to verify their versions' 7 which is a user 
request to determine when a file is modified and whenever a file 
is modified to an incorrect version it is replaced with the 
correct version, i.e. updating the file, from a cache. This 
updating of files, from a cache, can be from either Nx a local 
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path or network path." Therefore, WFP discloses updating from a 
remote location via a network. 

Group #5: Claims 12 and 25 

Appellant argues that WFP fails to disclose conditionally 
preventing the writes to the files on the computer based on a 
user confirmation. However, as discussed above WFP prevents the 
writes to a file and when the file is not found in the cache the 
system prompts a user to insert the appropriate media to replace 
the file. When the user inserts the media the file with the 
correct version is copied from the media and replaces the 
incorrect version of the file in the system thereby preventing 
the writing of the file with the incorrect version. Since this 
situation can only be done with a user inserting the media it is 
based on the users confirmation of the prompt from WFP. 

Group #6: Claim 30 

Appellant argues that WFP fails to disclose the factors 
include a list of critical files such that the list of critical 
files is updated based on the requests. With respect to this 
argument when the cache does not hold all of the critical files 
specified on page 2, and a modification is made to a critical 
file not in the list, the media (Windows 200 CD-ROM) is inserted 
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and the list now contains all the files and the list is thereby 
updated based on the modification which corresponds to the write 
requests as described above. 

WFP in view of Rickey et al. and further in view of Stevens 

Group #7 : Claim 31 

This claim is newly rejected over WFP in view of Rickey et 
al and further in view of Stevens. WFP teaches altering a user 
when a file is modified, which corresponds to the request to 
write, in order to replace it with the correct version and 
Stevens teaches allowing a trusted application access and 
therefore does not allow untrusted application access. So the 
combination teaches alerting the user to deny writing a file of 
an incorrect version from an untrusted application. 

Claims 8 and 21 

Appellant argues that system of WFP in view of Rickey et 
al. and further in view of Stevens fails to disclose the factors 
include trusted applications that initiate the requests. 
However, Stevens teaches that trusted applications attempting 
access (therefore requesting access) are granted the requested 
access. As stated it would be obvious at the time of the 
invention to one of ordinary skill in the art to include these 
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trusted applications to initiate the requests of WFP. Therefore 
the modified WFP, Rickey et al, and Stevens system discloses the 
factors include trusted applications that initiate the requests. 
(11) Related Proceeding (s) Appendix 

No decision rendered by a court or the Board is identified 
by the examiner in the Related Appeals and Interferences section 
of this examiner's answer. 
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For the above reasons, it is believed that the rejections 
should be sustained. 

This examiner's answer contains a new ground of rejection 
set forth in section (9) above. Accordingly, appellant must 
within TWO MONTHS from the date of this answer exercise one of 
the following two options to avoid sua sponte dismissal of the 
appeal as to the claims subject to the new ground of rejection: 

(1) Reopen prosecution. Request that prosecution be 
reopened before the primary examiner by filing a reply under 37 
CFR 1.111 with or without amendment, affidavit or other 
evidence. Any amendment, affidavit or other evidence must be 
relevant to the new grounds of rejection. A request that 
complies with 37 CFR 41.39(b)(1) will be entered and considered. 
Any request that prosecution be reopened will be treated as a 
request to withdraw the appeal. 

(2) Maintain appeal. Request that the appeal be maintained 
by filing a reply brief as set forth in 37 CFR 41.41. Such a 
reply brief must address each new ground of rejection as set 
forth in 37 CFR 41.37(c) (1) (vii) and should be in compliance 
with the other requirements of 37 CFR 41.37(c). If a reply 
brief filed pursuant to 37 CFR 41.39(b) (2) is accompanied by any 
amendment, affidavit or other evidence, it shall be treated as a 
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request that prosecution be reopened before the primary examiner 
under 37 CFR 41.39(b) (1) . 

Extensions of time under 37 CFR 1.136(a) are not applicable 
to the TWO MONTH time period set forth above. See 37 CFR 
1.136(b) for extensions of time to reply for patent applications 
and 37 CFR 1.550(c) for extensions of time to reply for ex parte 
reexamination proceedings. 

Respectfully submitted, 



A Technology Center Director or designee must personally 
approve the new ground (s) of rejection set forth in section (9) 
above by signing below: 



MJP 



Matthew Smithers 



Conferees : 



Gilberto Barron 




